Peppol Network | Structure, Function and Why It Matters

Access Point

The access point is your gateway to the network. You can think of it as a digital post office. Every company that wants to send or receive documents in the Peppol network needs a connection to an access point.

Access points are operated by certified service providers. Only those accredited by a Peppol authority may operate one. Companies can in theory get certified themselves, which involves high technical and organisational requirements, or they use an existing provider.

Service Metadata Publisher (SMP)

The SMP works like an address book. Each participant publishes their receiving capabilities there: which document types they can receive, through which access point they are reachable, which formats they support.

When you want to send someone an invoice, the SMP helps determine exactly where the document needs to be delivered.

Service Metadata Locator (SML)

The SML is the central directory of the entire network. There is only one SML, operated centrally by Peppol. Its task: based on the recipient’s unique address, identify which SMP holds a participant’s delivery details.

In simple terms, this works similarly to how the World Wide Web finds websites by their domain names. The SML is the core service that identifies all trusted access points and SMPs.

Public Key Infrastructure (PKI)

Security in the Peppol network is based on a Public Key Infrastructure. When a provider signs the Peppol agreements, they receive a digital certificate. This certificate validates all communication in the network and ensures that only known and trusted providers participate. If a provider violates the rules, the certificate can be revoked.

The data transfer itself runs encrypted via the AS4 protocol, the technical standard for secure exchange in the Peppol network.

How sending an e-invoice works

The interplay of the building blocks becomes clear in the actual process. Experts call it the four-corner model.

1. The sender (corner 1) creates the invoice and hands it to their access point (corner 2), together with the recipient’s unique address.
2. The sender’s access point queries the SML to find out which SMP is responsible for this recipient.
3. The SMP provides the technical details: through which access point (corner 3) the recipient is reachable and which documents they accept.
4. The recipient’s access point (corner 3) delivers the document to the recipient (corner 4), where it can be processed directly.

The advantage of this model: sender and recipient do not need to know each other or build their own connection. The network handles delivery. That is what makes Peppol so scalable.

From four-corner to five-corner model

With the EU initiative ViDA (VAT in the Digital Age), the model is evolving. In the so-called five-corner model, the tax authority is added as an additional participant. Invoice data is then not only exchanged between business partners but also reported to the tax authorities in parallel.

This is the direction e-invoicing is heading in Europe: away from pure transmission, towards a system that integrates compliance and reporting directly. For companies, this means that a clean Peppol connection today lays the foundation for tomorrow’s requirements.

Why Peppol matters with the mandate from 2027

E-invoicing in Germany is no longer optional in the B2B sector. The timeline at a glance:

• Since 1 January 2025: all companies must be able to receive e-invoices.
• From 1 January 2027: companies with more than 800,000 euros prior-year revenue must send e-invoices.
• From 1 January 2028: the obligation to send applies to all companies in B2B.

The law does not prescribe a specific transmission network. Sending by email remains possible for now. But many experts argue for a unified transmission channel. Peppol is the candidate that lends itself to this, because it is already used by federal and state authorities and many public clients.

Those who adopt Peppol today are prepared for the coming stages. We have compiled the details on deadlines, formats and obligations on our page about e-invoicing in Germany.

Recent developments in the German Peppol network

The network does not stand still. Two recent developments from Germany are worth mentioning.

KoSIT, the German Peppol authority, introduced GEBA (German Electronic Business Address) in 2025. It is based on the new Business Identification Number and creates a standardised addressing scheme for German companies in the Peppol network. The specification is published by KoSIT. Existing Peppol addresses such as the VAT ID remain valid; GEBA is an additional option.

In parallel, the invoice format is evolving. With XRechnung 4.0, based on the revised EN 16931 standard, the data model becomes more flexible and more oriented towards B2B business. This is an important building block for the upcoming mandate.

These developments show that Peppol is a living network that adapts to the needs of business and legislation. BESITEC is active in the OpenPeppol community and follows these developments first-hand.

How to become part of the Peppol network

To send and receive documents via Peppol, you need a connection to an access point. The process is straightforward: you choose a certified provider, receive a Peppol address and are connected to the entire network through it.

BESITEC is a certified Peppol Access Point Provider and supports you from the first question to ongoing operation. Whether you send just a few invoices or want to connect your ERP system fully, we find the right solution.

For an overview of which countries participate in Peppol worldwide and which authorities are behind them, see our page Peppol worldwide.